Use this when the user wants a high-level overview or dashboard of their entire cloud infrastructure. Returns cost by cloud provider, top services per cloud, top projects per cloud, recent cost anomalies, and recent cloud incidents — all in a single call. Do NOT use this for detailed drill-downs (use run_query), single-provider analysis, or anomaly-only queries.

Use this when the user wants to check for active cloud platform outages, service disruptions, or incidents from AWS, Google Cloud, or Azure. Do NOT use this for cost anomalies (use get_anomalies) or support tickets (use list_tickets).

Use this when the user wants to view details of a specific cloud platform incident. Accepts either the incident ID or a partial title match (case-insensitive). Do NOT use this for listing all incidents (use get_cloud_incidents) or anomalies (use get_anomalies).

Use this when the user wants to check for unexpected cost spikes, billing anomalies, or unusual spending patterns. Returns recent anomalies with severity and impact. Do NOT use this for optimization recommendations or savings opportunities (use list_optimization_recommendations), regular cost analysis (use run_query), or viewing alerts (use list_alerts).

Use this when the user wants to view details of a specific cost anomaly by its ID. Returns full anomaly data including affected resources and cost impact. Do NOT use this for listing all anomalies (use get_anomalies).

Use this when the user wants to see their saved Cloud Analytics reports or browse available reports. Returns a paginated list of reports with their IDs and metadata. Do NOT use this for running queries (use run_query) or getting report results (use get_report_results).

Use this when the user wants to analyze cloud costs, generate a cost breakdown, view spending trends, or run a custom analytics query across their cloud providers. Accepts a structured config with data source, metrics, dimensions, time range, and filters. Do NOT use this for listing saved reports (use list_reports), checking anomalies (use get_anomalies), or viewing budgets (use list_budgets). Fields that are not populated will use their default values if needed. To limit the number of rows returned per group, set the limit.value field inside each config.group[] entry (maximum 25). If possible, use timeRange instead of customTimeRange when no specific dates are given. Use "includeCurrent": true to include the current in-progress month. Use "includeCurrent": false only when asking about a fully completed past period. Always use "metrics" (array) not the deprecated "metric" (object).

ALWAYS include a "group" with id "service_description" and type "fixed" unless the user explicitly asks to group by something else. This gives a per-service cost breakdown which is always the most useful default.

Common grouping dimension IDs (all type "fixed"):
  "service_description" — cloud service (default)
  "project_id"          — GCP project / AWS account / Azure subscription (use when user asks to group by project, account, or subscription)
  "cloud_provider"      — cloud provider (AWS / GCP / Azure)

IMPORTANT — filter values are dimension IDs, never display names. Before filtering on any dimension
you are unsure about, call get_dimension({type, id}) to retrieve the exact valid values for this customer.
Known cloud provider IDs (cloud_provider, type "fixed"):
  "amazon-web-services" = AWS, "google-cloud" = GCP, "microsoft-azure" = Azure

Example — top AWS services last month:
{
  "config": {
    "dataSource": "billing",
    "metrics": [{"type": "basic", "value": "cost"}],
    "timeRange": {"mode": "last", "amount": 1, "unit": "month", "includeCurrent": true},
    "filters": [{"id": "cloud_provider", "type": "fixed", "values": ["amazon-web-services"]}],
    "group": [{"id": "service_description", "type": "fixed", "limit": {"metric": {"type": "basic", "value": "cost"}, "sort": "desc", "value": 10}}]
  }
}

Use this when the user wants a simple cost breakdown by service, project, or cloud provider (e.g. 'What are my top services by cost?', 'Which projects cost the most?'). Returns the top-N items ranked by cost descending. For complex multi-filter or multi-metric queries, use run_query instead.

Use this when the user wants to see monthly spend over time (e.g. 'Show me my cost trend', 'How has my spend changed over the last 6 months?'). Returns monthly cost data points, optionally broken down by service/project/cloud. For daily granularity or custom time intervals, use run_query instead.

Use this when the user wants to compare spend between two time periods (e.g. 'Compare my costs this quarter vs last quarter', 'How did January compare to February?'). Period 1 is a rolling lookback; period 2 is an explicit date range. For more than two periods or advanced comparative analysis, use run_query instead.

Use this when the user asks about optimization, recommendations, insights, savings opportunities, rightsizing, idle resources, security findings, or cost reduction suggestions. Also use this when the user asks 'what insights are available?' or 'show me insights'. This is the primary tool for 'what can I optimize?', 'how can I save money?', and 'what insights do I have?' questions. Returns a prioritized list of actionable insights with estimated daily savings. Do NOT use this for cost anomalies/spikes (use get_anomalies) or budget tracking (use list_budgets).

Use this when the user wants to see which specific resources are affected by an optimization insight. Returns resource IDs, accounts, potential savings, and remediation details. Do NOT use this for listing all insights (use list_insights).

Use this when the user wants the details and aggregate summary (savings, risk counts, status, description) of a single optimization insight identified by its source and key. Returns the insight metadata only — it does NOT include the individual affected resources (use get_insight_resources for those) and is not for listing all insights (use list_optimization_recommendations).

Use this when the user wants to create a new custom insight or update an existing one's metadata (title, description, categories, status, remediation links). Only insights owned by the 'public-api' source can be managed. This manages the insight's metadata only — the individual affected resources are managed separately (post_insight_resource_results). Do NOT use this only to change an insight's status (use update_insight_status).

Use this when the user wants to change the display status of an existing insight (e.g. mark it acknowledged, in progress, optimized, or dismissed). Only insights owned by the 'public-api' source can be managed. When dismissing, an optional reason and comment can be supplied. Do NOT use this to edit an insight's title/description or create one (use post_insight_result).

Use this when the user wants to retrieve the data results of a specific saved report. Accepts either the report ID or a partial name (case-insensitive). Do NOT use this for listing all reports (use list_reports) or running ad-hoc queries (use run_query).

Get the configuration of a specific Cloud Analytics report by ID. Returns the stored report object including name, type, and a nested 'config' field containing data source, metrics, dimensions, time range, filters, and visualization settings.

Use this when the user wants to save a new Cloud Analytics report with a specific configuration. Ask the user to confirm the report parameters before executing. Do NOT use this for one-time queries without saving (use run_query).

Use this when the user wants to modify an existing saved Cloud Analytics report. Supports partial updates. Ask the user to confirm changes before executing. Do NOT use this for running ad-hoc queries (use run_query).

Use this ONLY when the user explicitly asks to verify their account connection or check who they are logged in as. Do NOT call this proactively before other tool calls — the OAuth token already guarantees the user is authenticated. Do NOT use this for listing users in the organization (use list_users).

Use this when the user wants to see available dimensions for cost analysis queries. Returns a list of dimension types and values that can be used with run_query. Do NOT use this for running cost queries directly (use run_query) or viewing allocations (use list_allocations).

Use this to look up the valid filter values for a specific dimension before calling run_query — for example, call get_dimension({type: 'fixed', id: 'cloud_provider'}) to get the exact provider IDs available for this customer. Also use this when the user wants to view dimension details. Do NOT use this for listing all dimensions (use list_dimensions) or running queries (use run_query).

Use this when the user wants to view their support tickets, check ticket status, or review open issues. Returns tickets with status, priority, and platform. Supports partial subject filtering. Do NOT use this for cloud incidents (use get_cloud_incidents) or cost alerts (use list_alerts).

Returns details of a specific support ticket from the DoiT API by its ID.

Returns all comments on a support ticket. For customers, only public comments are returned. For DoiT employees, both public and private comments are returned.

Adds a comment to an existing support ticket. For customers, comments are always public. For DoiT employees, comments can be marked as private (internal notes) by setting the private field to true.

Use this when the user wants to create a new support ticket. Ask the user to confirm the ticket details before executing. Do NOT use this for viewing existing tickets (use list_tickets) or cloud incidents (use get_cloud_incidents).

Use this when the user wants to see their invoices, check billing history, or review payment records. Returns a list of invoices with amounts, dates, and status. Do NOT use this for cost analysis (use run_query) or budget tracking (use list_budgets).

Use this when the user wants to view details of a specific invoice by its ID. Returns full invoice data including line items and status. Do NOT use this for listing all invoices (use list_invoices) or cost analysis (use run_query).

Use this when the user wants to see their cost allocation rules or configurations. Returns a list of allocations. Supports partial name filtering. Do NOT use this for cost queries (use run_query) or labels (use list_labels).

Use this when the user wants to view details of a specific cost allocation. Accepts either the allocation ID or a partial name (case-insensitive). Do NOT use this for listing all allocations (use list_allocations) or running queries (use run_query).

Use this when the user wants to create a new cost allocation rule. Ask the user to confirm the allocation parameters before executing. Do NOT use this for viewing existing allocations (use list_allocations) or labels (use create_label).

Use this when the user wants to modify an existing cost allocation. Ask the user to confirm changes before executing. Do NOT use this for creating new allocations (use create_allocation) or viewing allocations (use list_allocations).

Use this when the user wants to browse their cloud assets, subscriptions, or resources. Returns a paginated list of assets. Supports partial name filtering. Do NOT use this for cost analysis (use run_query) or checking invoices (use list_invoices).

Use this when the user wants to view details of a specific cloud asset. Accepts either the asset ID or a partial name (case-insensitive). Do NOT use this for listing all assets (use list_assets) or cost analysis (use run_query).

DoiT-internal (doer) tool: search across ALL DoiT customers by what they have — classification/kind, customer type, segment, tier package, domains, cloud asset platforms (AWS, GCP, Google Workspace, Office 365, Azure), Flexsave, standalone (direct self-serve) cloud assets, monthly cloud spend, invoiced spend over a month range, and active contracts. All provided conditions are AND-combined; within a list field the match is any-of. Returns matching customers with a summary and a nextPageToken for paging. Requires DoiT employee access (non-doers get an authorization error). Use this to FIND customers across the base; use other tools to drill into a specific customer.

Use this when the user wants to see their cost alerts or check alert configurations. Returns a paginated list of alerts. Do NOT use this for anomaly detection (use get_anomalies) or budget tracking (use list_budgets).

Use this when the user wants to view the details of a specific cost alert. Accepts either the alert ID or a partial name (case-insensitive). Do NOT use this for listing all alerts (use list_alerts) or anomalies (use get_anomalies).

Use this when the user wants to set up a new cost alert with thresholds and notification settings. Ask the user to confirm the alert parameters before executing. Do NOT use this for creating budgets (use create_budget) or viewing existing alerts (use list_alerts).

Use this when the user wants to modify an existing cost alert. Supports partial updates. Ask the user to confirm changes before executing. Do NOT use this for creating new alerts (use create_alert) or budgets (use create_budget).

Use this when the user wants to trigger an automated CloudFlow workflow by its flow ID. This executes automation that may modify cloud resources externally. Ask the user to confirm the flow ID and any parameters before executing. Do NOT use this for viewing CloudFlow definitions or checking available flows.

Use this when the user wants to see their CloudFlow automation flows. Returns a cursor-paginated list of flows with their metadata, status, and last execution info.

Use this when the user wants to see their CloudFlow cloud provider connections (the GCP/AWS accounts connected for automation). Returns a cursor-paginated list of connections with their config and status. Do NOT use this to trigger a flow (use trigger_cloud_flow) or to view a single connection's details (use get_cloudflow_connection).

Use this when the user wants to view the details of a specific CloudFlow cloud provider connection by its ID, including its GCP/AWS configuration, collaborators, and status. Do NOT use this to list all connections (use list_cloudflow_connections) or to trigger a flow (use trigger_cloud_flow).

Use this when the user wants to create a new CloudFlow cloud provider connection (a GCP or AWS account connected for automation). Exactly one of gcpConfig or awsConfig must be supplied. Ask the user to confirm the connection details before executing. Do NOT use this to update an existing connection (use update_cloudflow_connection) or to trigger a flow (use trigger_cloud_flow).

Use this when the user wants to update an existing CloudFlow cloud provider connection — rename it, change its description, enable/disable it, update its GCP/AWS configuration, or change collaborators. All fields except connectionId are optional; at most one of gcpConfig or awsConfig may be set per request. Ask the user to confirm the changes before executing. Do NOT use this to create a new connection (use create_cloudflow_connection) or to trigger a flow (use trigger_cloud_flow).

Use this when the user wants to see the catalogue of available CloudFlow templates (read-only blueprints they can build a flow from). Returns a cursor-paginated list of templates with their id, name, description, and instructions. Do NOT use this to view a single template's details (use get_cloudflow_template) or to trigger a flow (use trigger_cloud_flow).

Use this when the user wants to view the details of a specific CloudFlow template by its ID, including its name, description, and configuration instructions. Do NOT use this to list all templates (use list_cloudflow_templates) or to trigger a flow (use trigger_cloud_flow).

Use this when the user wants to refine or rebuild an existing CloudFlow automation using natural language. Streams real-time progress updates while the AI builds the flow, then returns the final result.

Use this when the user wants to build a brand-new CloudFlow automation from scratch using natural language. Streams real-time progress while the AI builds the flow, then returns the newly created flow's ID, the builder's answer, and the build steps that ran. Use refine_cloudflow to change an existing flow; use this only to create a new one.

Use this when the user wants to see the organizations in their DoiT account. Returns a list of organizations. Do NOT use this for listing users (use list_users) or platforms (use list_platforms).

Use this when the user wants to see available cloud platforms in their DoiT account. Returns a list of platforms. Do NOT use this for cloud incidents (use get_cloud_incidents) or products (use list_products).

Use this when the user wants to see users in their DoiT organization or check who has access. Returns a list of users with roles. Do NOT use this for listing roles (use list_roles) or validating the current user (use validate_user).

Use this when the user wants to update a user's information such as name, job function, phone, language, or role. Ask the user to confirm the changes before executing. Do NOT use this for inviting new users (use invite_user) or listing users (use list_users).

Use this when the user wants to invite a new person to the organization. Ask the user to confirm the email, role, and organization before executing. Do NOT use this for updating existing users (use update_user) or listing users (use list_users).

Use this when the user wants to see available roles in their DoiT organization. Returns a list of roles with permissions. Do NOT use this for listing users (use list_users) or organizations (use list_organizations).

Use this when the user wants to see available DoiT products or services. Returns a list of products. Do NOT use this for cloud incidents (use get_cloud_incidents) or platforms (use list_platforms).

Use this when the user wants to see their resource labels or label configurations. Returns a list of labels with their metadata. Do NOT use this for annotations (use list_annotations) or label assignments (use get_label_assignments).

Use this when the user wants to view details of a specific label. Accepts either the label ID or a partial name (case-insensitive). Do NOT use this for listing all labels (use list_labels) or annotations (use list_annotations).

Use this when the user wants to create a new resource label. Ask the user to confirm the label details before executing. Do NOT use this for viewing existing labels (use list_labels) or annotations (use create_annotation).

Use this when the user wants to modify an existing label. Supports partial updates. Ask the user to confirm changes before executing. Do NOT use this for creating new labels (use create_label) or annotations (use update_annotation).

Use this when the user wants to see which resources are assigned to a specific label. Returns a list of assigned objects. Do NOT use this for viewing label details (use get_label) or allocations (use list_allocations).

Use this when the user wants to assign or unassign cloud resources to a label. Ask the user to confirm the assignments before executing. Do NOT use this for creating labels (use create_label) or viewing assignments (use get_label_assignments).

Use this when the user wants to see their Cloud Analytics folders, which organize reports and allocations into a hierarchy. Returns a list of folders with their metadata. Do NOT use this for listing reports (use list_reports) or labels (use list_labels).

Use this when the user wants to view details of a specific Cloud Analytics folder. Accepts either the folder ID or a partial name (case-insensitive). Do NOT use this for listing all folders (use list_folders) or viewing reports (use get_report_config).

Use this when the user wants to create a new Cloud Analytics folder to organize reports and allocations. Ask the user to confirm the folder details before executing. Do NOT use this for creating reports (use create_report) or labels (use create_label).

Use this when the user wants to rename, re-describe, or move (reparent) an existing Cloud Analytics folder. Ask the user to confirm changes before executing. Note: if a sibling folder at the target parent already has the same name, the folder will be auto-renamed by the API. Do NOT use this for creating new folders (use create_folder) or updating reports (use update_report).

Use this when the user wants to see the custom color themes defined for their account, which control the colors applied to Cloud Analytics reports. Returns a list of themes with their metadata. Do NOT use this for listing reports (use list_reports) or labels (use list_labels).

Use this when the user wants to view details of a specific custom color theme. Accepts either the theme ID or a partial name (case-insensitive). Do NOT use this for listing all themes (use list_themes).

Use this when the user wants to know which color theme is currently active for their account (the theme applied to Cloud Analytics reports). Returns the active theme id; the reserved sentinel "default" means no custom or preset theme is selected and the built-in default is in use. Do NOT use this to list all themes (use list_themes) or to fetch a specific theme by id (use get_theme).

Use this when the user wants to change or activate a custom color theme for their Cloud Analytics reports. Accepts a theme ID or the sentinel "default" to revert to the built-in default. Ask the user to confirm the change before executing. Do NOT use this to retrieve the current active theme (use get_active_theme) or to update theme colors (use update_theme).

Use this when the user wants to modify an existing custom color theme — rename it, change its primary color, or update its color palette. Accepts either the theme ID or a partial name match. Ask the user to confirm changes before executing. Do NOT use this for creating a new theme or changing which theme is active (use set_active_theme).

Use this when the user wants the CloudConnect details of a specific connected AWS account, such as its IAM role ARN, billing S3 bucket, and which DoiT features are enabled or supported. Requires the 12-digit AWS account ID. Do NOT use this for Google Cloud or Azure accounts.

Use this when the user wants to know which DoiT CloudConnect features a connected cloud account supports and whether the account currently has the required permissions for each feature. Accepts an AWS account ID or Azure tenant ID. Returns the list of supported features with their permission status.

Use this when the user wants to see available DataHub datasets. Returns a list of datasets with metadata. Do NOT use this for billing data (use run_query) or assets (use list_assets).

Use this when the user wants to view details of a specific DataHub dataset by its ID. Returns full dataset metadata and schema. Do NOT use this for listing all datasets (use list_datahub_datasets) or cost queries (use run_query).

Use this when the user wants to create a new DataHub dataset. Ask the user to confirm the dataset name and description before executing. Do NOT use this for viewing datasets (use list_datahub_datasets) or sending events (use send_datahub_events).

Use this when the user wants to modify an existing DataHub dataset's description. The dataset name is required to identify the dataset; only the description can be changed. Ask the user to confirm the changes before executing. Do NOT use this for creating datasets (use create_datahub_dataset) or listing datasets (use list_datahub_datasets).

Use this when the user wants to send DataHub events for ingestion (1–50,000 events per call). Each event requires a provider name and an RFC 3339 timestamp, and can optionally include dimensions and metrics. Ask the user to confirm the event count and provider details before executing. Data becomes available in Cloud Analytics within ~15 minutes. Do NOT use this for creating datasets (use create_datahub_dataset) or viewing datasets (use list_datahub_datasets).

Use this when the user wants to find architecture diagrams or cloud infrastructure diagrams. Returns matching diagram files. Do NOT use this for cost analysis (use run_query) or incidents (use get_cloud_incidents).

Use this when the user wants activity statistics for their cloud infrastructure diagrams over a time period — node create/update/delete change counts grouped by cloud service, plus each diagram's import/sync state. Useful for change auditing and drift detection. Requires a start and end RFC3339 date-time.

Use this when the user wants to search their cloud infrastructure diagrams and components by name or property. Returns matching diagram layers (scheme), components, and components matched by property value (prop). Optionally scope to a single layer with ss_id and page with from/size. Do NOT use this for cost analysis (use run_query) or incidents (use get_cloud_incidents).

Use this when the user wants a cost snapshot for a specific cloud infrastructure diagram layer over a time period — total spend, period-over-period trend percentage, the top resources and services by cost, and a cost trend over time. Requires the diagram layer ID and a startDate/endDate (YYYY-MM-DD). Do NOT use this for account-wide cost analysis (use run_query) or budgets (use list_budgets).

Use this when the user wants to understand how a specific resource in a cloud infrastructure diagram is connected to other resources — its upstream/downstream edges and group membership. Returns the anchor resource plus related resources with their relation type and hop distance. Requires the diagram layer ID and the resource ID. Do NOT use this for cost analysis (use get_cloud_diagram_cost_snapshot or run_query).

Use this when the user wants the change history of a cloud diagram layer grouped by snapshot. Returns snapshot activity groups for the given layer (ss_id), ordered by timestamp descending; each group references a snapshot and contains the individual activity records (node/link/group/attachment create/update/delete) that belong to it. Page with offset/limit and filter with tags. Do NOT use this for cost analysis (use run_query) or incidents (use get_cloud_incidents).

Use this when the user wants the change history of a single component node in a cloud diagram layer. Returns individual activity records (NODE_CREATE/NODE_UPDATE/NODE_DELETE) for the given node (ss_id + nodeId), ordered by timestamp descending, each including the user who made the change. Page with offset/limit. Do NOT use this for cost analysis (use run_query) or incidents (use get_cloud_incidents).

Use this when the user wants to discover all cloud infrastructure diagrams and their layers (statussheets), or to look up layer IDs needed for other diagram endpoints. Returns all diagrams with their connected layers and optionally their component data. This is the primary discovery endpoint — use it before calling endpoints that require a layer ID. Optionally filter by diagram IDs (scheme_ids) or layer IDs (layer_ids), and set include_components=true to get full component lists. Do NOT use this for cost analysis (use run_query) or diagram search (use search_cloud_diagrams).

Use this when the user wants to see their cloud spending budgets or check budget status. Returns a paginated list of budgets with names, amounts, and utilization. Do NOT use this for cost analysis (use run_query) or spending alerts (use list_alerts).

Use this when the user wants to view the details and current utilization of a specific budget. Accepts either the budget ID or a partial name (case-insensitive). Do NOT use this for listing all budgets (use list_budgets) or cost analysis (use run_query).

Use this when the user wants to create a new cloud budget with spending limits and alert thresholds. Requires budget name, currency, type, and start period. Ask the user to confirm the budget parameters before executing. Do NOT use this for viewing existing budgets (use list_budgets or get_budget) or creating alerts (use create_alert).

Use this when the user wants to modify an existing budget. Supports partial updates. Ask the user to confirm the changes before executing. Do NOT use this for viewing budgets (use list_budgets) or creating new budgets (use create_budget).

Use this when the user wants to see calendar annotations or notes on cost data. Returns a list of annotations. Do NOT use this for labels (use list_labels) or alerts (use list_alerts).

Use this when the user wants to view details of a specific annotation. Accepts either the annotation ID or a partial content match (case-insensitive). Do NOT use this for listing all annotations (use list_annotations) or labels (use list_labels).

Use this when the user wants to add a new annotation to mark a specific date or event in cost data. Ask the user to confirm the annotation details before executing. Do NOT use this for creating labels (use create_label) or alerts (use create_alert).

Use this when the user wants to modify an existing annotation. Ask the user to confirm changes before executing. Do NOT use this for creating new annotations (use create_annotation) or labels (use update_label).

Returns a list of commitment contracts from the DoiT Commitment Manager. These are Enterprise Discount Program (EDP) agreements — negotiated minimum spend or usage commitments between the customer and a cloud provider (Google Cloud, AWS, or Azure) .

Returns details of a specific Enterprise Discount Program (EDP) commitment contract, identified by its ID. Includes the full breakdown of commitment periods, per-period contracted values, and current spend attainment against the committed amount.

Use this when the user wants to know who their DoiT account team / account managers are. Returns the list of account managers assigned to the customer, including name, email, role, and Calendly scheduling link. Do NOT use this for listing platform users (use list_users) or organizations (use list_organizations).

Use this when the user wants to see who a Cloud Analytics resource is shared with and at what access level. Returns the sharing settings (per-user roles and public visibility) for a specific alert, budget, report, or allocation. Requires resourceType (alerts, budgets, reports, or allocations) and resourceId. Do NOT use this to list the resources themselves (use list_alerts, list_budgets, list_reports, or list_allocations).

Use this when the user wants to change who a Cloud Analytics resource is shared with or update access levels. Updates the sharing settings (per-user roles and/or public visibility) for a specific alert, budget, report, or allocation. Requires resourceType and resourceId; at least one of permissions or public should be provided. Do NOT use this to view current permissions (use get_resource_permissions).

Ask DoiT AVA, the cloud cost and infrastructure expert, a question about the user's DoiT account, cloud spending, anomalies, or optimization opportunities. AVA has access to the customer's billing data, usage patterns, and DoiT-specific features. Use this for DoiT or cloud-specific questions only — not for general-purpose AI queries. Note: AVA can take a long time to respond for complex questions. If it does not respond in time, a clear error is returned with guidance to retry or simplify the question.

Finalizes a pending write action (e.g. creating, updating, or deleting a resource) that was previously staged by another tool. Only call this after the user has explicitly confirmed the action summary returned by the previous tool call. If the user declined, do not call this tool — the token will expire automatically. Pass the token exactly as it was returned.

Notifications triggered when cloud costs exceed defined thresholds or meet specific conditions. Deletes the alert specified by the Id.

Define how costs are distributed across your organization. Deletes the allocation specified by the Id.

Custom notes added to cost data to provide contextual information. Deletes the annotation specified by the Id.

Create and manage labels to organize and categorize your cloud resources. Deletes the label specified by the Id.

Creates a new custom color theme. Requires Cloud Analytics Admin permission.

Deletes the custom theme specified by the Id. Requires Cloud Analytics Admin permission.

Track actual cloud spend against planned spend. Deletes the specified budget.

AI-generated budget recommendations you can accept (link to a budget you created) or dismiss. Returns the pending AI-generated budget suggestions for your account. The set is small (a handful of pending suggestions) and is returned in full. Each suggestion can be accepted (after you create a matching budget via POST /analytics/v1/budgets) or dismissed.

AI-generated budget recommendations you can accept (link to a budget you created) or dismiss. Marks the suggestion as accepted and links it to an existing budget. Create the budget first via POST /analytics/v1/budgets, then pass its id as budgetId. The budget must belong to your account.

AI-generated budget recommendations you can accept (link to a budget you created) or dismiss. Marks the suggestion as dismissed so it no longer appears in the pending list.

Organize Cloud Analytics resources (reports, allocations) into folders. Deletes the specified folder. All nested folders will be deleted. Any reports or allocations contained in the folder are moved to the root.

Manage Cloud Analytics reports and get reports data in JSON format. Deletes the specified Cloud Analytics report.

Manage Cloud Analytics reports and get reports data in JSON format. Submits an async report execution job using an inline configuration. Returns 202 immediately with a Location header pointing to the operation status endpoint. Requires the Idempotency-Key header to ensure at-most-once submission. Duplicate requests with the same config for the same customer return the existing in-flight operation. Use ?dryRun=true to validate the config without creating an operation.

Manage Cloud Analytics reports and get reports data in JSON format. Returns the current status of an async report operation. Non-terminal operations (pending, running) include a Retry-After header suggesting when to poll again. This endpoint does not return result data — once status is "succeeded", fetch the result from the operation's results endpoint. When status is "failed", the error field contains an RFC 9457-shaped error. Returns 404 if the operationId does not exist, belongs to a different tenant, or has expired.

Manage Cloud Analytics reports and get reports data in JSON format. Submits an async execution job for a saved report identified by ID. Returns 202 immediately with a Location header pointing to the operation status endpoint. Requires the Idempotency-Key header. Use ?dryRun=true to validate without creating an operation.

Manage Cloud Analytics reports and get reports data in JSON format. Cancels a pending or running async report operation. Already-terminal operations (succeeded, failed, canceled) are returned as-is without any state change (idempotent). Returns 404 if the operationId does not exist or belongs to a different tenant. Use ?dryRun=true to validate the request without modifying any state.

Manage Cloud Analytics reports and get reports data in JSON format. Returns the result of a succeeded async report operation, including report metadata (id, reportName, owner, type, createTime, updateTime, urlUI) when the operation was started against a saved report — the same shape as the sync GetReportResponse, instead of requiring a second call to GET /analytics/v1/reports/{id}/config for it. Returns 404 if the operationId does not exist, has expired, or belongs to a different tenant. Returns 425 Too Early if the operation has not yet reached a terminal state — poll the operation status endpoint, which returns its own Retry-After guidance, until it succeeds. Returns 422 if the operation terminated as failed or canceled. The poll status endpoint response does not include result data inline — this is the only endpoint that returns it.

List and manage tenant-scoped contracts as a T1/T2 PartnerOps caller. Lists the contracts held by the specified customer. Callable by a T1/T2 PartnerOps principal for its own tenant or any descendant tenant. Read access requires contractsReadOnly, contractsViewer, or a write-capable role (without contractsReadOnly). User API tokens must include the matching permission in their scope.

List and manage tenant-scoped contracts as a T1/T2 PartnerOps caller. Returns the specified contract.

Manage cloud resources or services in your cloud environment. Creates a new asset.

Ingest third-party cost, usage, and metric-based data for analysis. Sends a batch of events to DataHub using a CSV file, either uncompressed or compressed in ZIP or GZ format. It may take up to 15 minutes for the data to become available in the DoiT console.

Ingest third-party cost, usage, and metric-based data for analysis. Deletes specific events using filters. Note that the two filters, eventIds and time ranges, are mutually exclusive.

Ingest third-party cost, usage, and metric-based data for analysis. Deletes one or more DataHub datasets and all their associated data.

Ingest third-party cost, usage, and metric-based data for analysis. Deletes a specific DataHub dataset.

Explain month-over-month changes in invoiced cloud costs. Returns the invoiced cost changes for each payer in the authenticated tenant.

Explain month-over-month changes in invoiced cloud costs. Returns invoiced cost changes for an invoice owned by the specified billing profile in the authenticated tenant.

Monitor cloud service quota usage across connected accounts and projects. Returns the latest service quota usage snapshots collected by DoiT for the authenticated customer. Results include only quotas retained by DoiT's monitoring collectors and are not a complete or live inventory from the cloud providers. Results are sorted by utilization percentage in descending order. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Manage contract templates for PartnerOps resellers (T1/T2). Lists contract templates owned by the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (platform:externalApi), and the channelops:contracts:templates entitlement.

Manage contract templates for PartnerOps resellers (T1/T2). Returns a single contract template owned by the authenticated tenant (from the bearer token). Requires ContractTemplatesAdmin, DoiT API access (platform:externalApi), and the channelops:contracts:templates entitlement.

Read and update your organization's general settings. Returns the customer, including its general settings and contact info, scoped to {customerId}. {customerId} must match the customer resolved from the bearer token; a token scoped to a different customer gets 403, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the Settings permission and DoiT API access (platform:externalApi).

Read and update your organization's general settings. Partially updates the general settings and contact info of the customer identified by {customerId}. {customerId} must match the customer resolved from the bearer token; a token scoped to a different customer gets 403, even if that customer would otherwise be reachable through a reseller/MTS relationship. Requires the Settings permission and DoiT API access (platform:externalApi); updating allowedInviteDomains additionally requires the UsersManager permission.

The request body must use application/merge-patch+json (RFC 7396): an omitted field leaves the current value unchanged, and an explicit null also leaves it unchanged, except for urlSlug, where an explicit empty string removes the customer's active URL slug rather than leaving it unchanged.

Fields are nested exactly as getCustomer returns them - currency and allowedInviteDomains under settings, emails under contact - so every value is read and written at the same path. settings.currency accepts only the codes listed in the schema and cannot be cleared; allowedInviteDomains and contact.emails are cleared with an empty array.

Manage users who have access to the DoiT platform. Deletes a user.

Manage users who have access to the DoiT platform. Resets the invite expiry to 48 hours from now, invalidates the previous invite token (so old email links stop working), and triggers a fresh invitation email. Works on invites in any state including Cancelled — resending a cancelled invite reactivates it to Pending.

Returns 404 if no invite exists for the given ID (never created, or already accepted and removed).

Requires usersManager permission.

Manage users who have access to the DoiT platform. Marks the invite as Cancelled and invalidates the invite token so any outstanding email links stop working. The invite document is retained (soft cancel) — the user row remains visible in GET /iam/v1/users with inviteStatus: Cancelled. Use DELETE /iam/v1/users/{id} to fully remove the record.

Returns 404 if no invite exists for the given ID, and 409 if the invite is already cancelled.

Requires usersManager permission.

Manage cloud resources or services in your cloud environment. Updates an existing asset, such as G Suite/Workspace or Office 365 subscription, to add or remove licenses.

Create and manage support tickets with DoiT. Partially updates a support request. Supports setting the request status and/or assignee. DoiT employees may set any of open, pending, hold, or solved and may set the assignee; customers may set only solved (parity with the console "mark as resolved" action) and may not set an assignee. closed is not settable via the API (Zendesk auto-closes from solved). The assignee is a DoiT-employee email, resolved server-side to a Zendesk agent; an email that does not resolve to an active agent returns 400. At least one mutable field must be present. The response echoes the fields that were applied.

Create and manage support tickets with DoiT. Returns the tags currently set on a support request.

DoiT employee (doer) callers receive the full tag set verbatim, including internal namespaces (e.g. tier/*, synapse_*). Customer callers receive only tags under the customer_tag/ namespace, with that prefix stripped (e.g. a tag added as billing reads back as billing). Always present; empty array when the caller has no visible tags.

Create and manage support tickets with DoiT. Adds one or more tags to an existing support request. The operation is surgical — only the tags listed in the request are added; existing tags on the ticket are preserved. Re-adding a tag that is already present is a successful no-op.

All submitted tags are normalized (trim + lowercase) before storage. For customers, the system additionally applies a customer_tag/ namespace prefix to prevent collisions with internal DoiT process tags. The response echoes the actual stored strings so callers can verify the transform.

Create and manage support tickets with DoiT. Removes one or more tags from an existing support request. The operation is surgical — only the tags listed in the request are removed; tags not listed are preserved. Removing a tag that is not present is a successful no-op.

For customers, the system applies the same customer_tag/ namespace mapping as on add, so a customer who added my_tag (stored as customer_tag/my_tag) can remove it by sending my_tag.

Cloud Diagrams visualize your cloud infrastructure and resource relationships. Returns the specified components of a diagram layer. Provide at least one component type with one or more IDs in the request body (for example, node or element).

Cloud Diagrams visualize your cloud infrastructure and resource relationships. Exports the full content of a diagram layer as a structured JSON document, including all components and export metadata.

Cloud Diagrams visualize your cloud infrastructure and resource relationships. Returns the list of saved snapshots for the specified diagram layer.

Cloud Diagrams visualize your cloud infrastructure and resource relationships. Returns a single snapshot of the specified diagram layer identified by its ID.

Interact with Ava, DoiT's AI-powered cloud assistant. Submit feedback on an Ava answer to help improve response quality.

Interact with Ava, DoiT's AI-powered cloud assistant. Deletes an Ava conversation by its ID.

Manage cloud insights representing recommendations and findings for cloud resources. Creates or updates multiple insights in a single batch request. Each insight in the batch includes its metadata and resource results inline. For granular control over insight metadata and resource results independently, use the single-insight and resource-results endpoints instead.

Manage cloud insights representing recommendations and findings for cloud resources. Deletes all insights matching the specified key from the batch source. This removes the insight and all its associated resource results. For single-insight deletion, use DELETE /source/{sourceID}/insight/{insightKey} instead.

Manage cloud insights representing recommendations and findings for cloud resources. Permanently deletes a single insight and all its associated resource results. Only insights created via the public API can be deleted.

Manage cloud insights representing recommendations and findings for cloud resources. Replaces all resource results for the specified insight. Any existing unresolved resource results not present in the new set will be removed. The response includes server-computed fields (severity, resolved, enhancement) for each resource result. To delete all resource results, send an empty array.

Manage cloud provider connections and check feature availability for connected accounts. Creates or updates a CloudConnect document for an AWS account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents or require a CloudFormation stack ID.

Manage cloud provider connections and check feature availability for connected accounts. Updates an AWS feature for an existing CloudConnect account. Unlike the CloudFormation variant, this endpoint does not update Firestore channel documents, require a CloudFormation stack ID, or handle StackSet member role ARNs.

Manage cloud provider connections and check feature availability for connected accounts. Deletes a CloudConnect document for an AWS account.

Manage cloud provider connections used in CloudFlow workflows (AWS and GCP). Deletes a connection. Returns 409 if the connection is referenced by one or more flows.

Manage CloudFlow. Runs a flow once as a test, and accepts an unpublished (draft) flow — unlike actions/trigger, which requires the flow to be published. Use this to verify a newly authored or edited flow before publishing it.

Execution is identical to a production run: the same graph, the same bound connections, the same credentials, and the same approval behaviour. An approval-gated node still parks the run and its side effect still waits for a real approval — there is no request that skips one.

The run is recorded as a test, so it does not appear in run history, does not count towards dashboard statistics, does not become a dashboard widget's data source, and does not consume a scheduled-run budget. It does hold the flow's concurrency lock, so a 409 is returned while the flow is already running.

The flow's first node must be a webhook, scheduled, or manual trigger.

Before dispatching, the flow is validated with the same checks publish applies — a draft has never been through them. A flow that fails returns 422 listing every offending node at once, so all of them can be fixed in one pass.

Poll the Location URL to follow the run and read what each node produced.

Pass ?dryRun=true to validate the flow without starting a run.

Manage CloudFlow. Returns a flow's runs, newest first. Use mode to separate test runs from production ones — test runs are included by default.

Per-node detail is not included here; fetch a single run to read what each node consumed and produced. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Manage CloudFlow. Returns a run's status and, for each node, the JSON it consumed and produced. This is how you find out why a run failed, or that it "succeeded" while producing the wrong data.

input is null for most node types, and that is not an error. Only action nodes — the AWS, GCP, Azure, Oracle, DoiT and admin operations — record their inputs. Transform, code, branch, switch, datastore, subflow and trigger nodes record none, so their input is always null. output is recorded by every node that finishes, so read a transform's behaviour from its output.

Payloads appear as soon as a node reports a terminal status, so a poll loop can read results while later nodes are still running.

Any value the node's schema marks sensitive is replaced with a redaction marker; credentials and connection configuration never appear.

Each input and output is capped at 64KB. When a payload exceeds that, whole entries are dropped from the end, truncated is true, and totalBytes reports the untruncated size — nothing is silently cut, and what you receive is always valid JSON.

Runs belonging to another tenant, or to a different flow, return 404. Nodes inside a fan-out currently report only the last path to finish.

Manage CloudFlow. Serializes the flow — plus every flow it references through subflow nodes — into a tenant-neutral, credential-free JSON bundle that can be imported into any tenant with the import operation. Tenant-scoped references (connections, Datastore tables, global variables) are declared as named requirements and rebound at import time; policy and Slack-channel references cannot travel and are recorded as unsupported references. The bundle never contains credentials, tenant identifiers, schedules, or execution state.

Manage CloudFlow. Creates every flow of a previously exported bundle in the authenticated tenant. Imports are create-only: each call creates new draft flows with new IDs — nothing is published and no schedule is activated until the target tenant publishes.

Requirements declared by the bundle are resolved through bindings (requirement key → target-tenant resource ID). Unbound connections and Datastore tables leave the referencing nodes flagged incomplete; unbound global variables are auto-created. Pass options.createMissingTables: true to create missing Datastore tables from the schemas embedded in the bundle (structure only, never row data).

Dry-run: pass ?dryRun=true to validate without writing. The response is an import plan: per-requirement resolutions with candidate bindings in the target tenant, the flows that would be created, and every validation issue at once.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns all AWS organizations (accounts) accessible to the authenticated tenant. Use as the entry point to discover AWS organization account IDs, and organization-level onboarding status of the available commitment types and savings metrics.

Each item includes metadata, trailing 30-day aggregate statistics, precomputed YTD/lifetime savings totals per Savings Plan (SP) type, and estimated monthly potential savings (monthlyPotentialSavings) per SP type from the latest projection. Sum across items for customer-level totals. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns a single AWS organization with the same list-item fields as List AWS Organizations, plus the Overview time series. Use this when you need a single organization's Console Overview in one call (identity and onboarding status, 30-day ESR and savings, YTD/lifetime totals, monthly potential savings, and the data behind Cost Summary and Commitment Coverage charts) without fetching every organization.

Fields that drive the Overview tab in the DoiT console:

• stats30d: last 30 days ESR and realized savings per SP type (ESR and Savings cards).

• monthlyStats: last 6 calendar months of ESR, on-demand cost, and cost with savings per SP type (Cost Summary chart, and month-over-month card trends).

• dailyCoverage: last 30 days of commitment coverage breakdown per SP type (Commitment Coverage chart).

• savingsTotals: year-to-date and lifetime realized savings per SP type (shown under the Savings card). Lifetime is bounded by PerfectScale for Commitments onboarding start.

• monthlyPotentialSavings: estimated monthly additional savings per SP type from the latest purchase projection.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns all member AWS accounts under the specified AWS organization that have active or historical commitment coverage. Includes 30-day statistics and estimated monthly potential savings (monthlyPotentialSavings) per Savings Plan (SP) type. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns a single member AWS account with the same list-item fields as List member accounts, plus the Overview time series. Use this when you need a single members Console Overview in one call (identity and onboarding status, 30-day ESR and savings, YTD/lifetime totals, monthly potential savings, and the data behind Cost Summary and Commitment Coverage charts) without fetching every member account.

Fields that drive the Overview tab in the DoiT console:

• stats30d: last 30 days ESR and realized savings per SP type (ESR and Savings cards).

• monthlyStats: last 6 calendar months of ESR, on-demand cost, and cost with savings per SP type (Cost Summary chart, and month-over-month card trends).

• dailyCoverage: last 30 days of commitment coverage breakdown per SP type (Commitment Coverage chart).

• savingsTotals: year-to-date and lifetime realized savings per SP type (shown under the Savings card). Lifetime is bounded by the parent organization's PerfectScale for Commitments onboarding start.

• monthlyPotentialSavings: estimated monthly additional savings per SP type from the latest purchase projection.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns a paginated list of Savings Plans for the specified AWS organization. Optionally filter by plan type (type) and state (status). Omit both filters to return all plans for the AWS organization. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns a paginated list of Reserved Instances (RIs) for the specified AWS organization. Optionally filter by state, instance type, instance family, region, and offering class. Omit filters to return all RIs for the AWS organization. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns commitment purchase recommendations for the AWS organization, keyed by commitment type (compute, database). A commitment type is present only when it is onboarded and a recommendation is available.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns the recommendation for one commitment type (serviceId) on the AWS organization, including analysis metrics and time-bucketed eligible spend. Use granularity to choose the eligible-spend bucket size (defaults to day).

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns planned purchases (laddering projections) for the AWS organization. One item per commitment type that has a projection available (typically compute and/or database; up to four commitment types as PerfectScale for Commitments expands).

With no filters, returns all available planned-purchase items for the AWS organization in stable commitment-type order (compute, then database, then any future commitment types in enum order). When a filtered commitment type has no planned purchases, the response is an empty items array (not 404). Partial items return only the fields available at response time.

404 is returned only when the AWS organization does not exist or the caller cannot access it. An AWS organization that is not onboarded for PerfectScale for Commitments still returns 200 with an empty items array when no planned purchases exist — use GET /ps4commitments/v1/aws/organizations (or get-by-id) for onboardingStatus.

Pagination: results are returned in stable commitment-type order (compute, then database, then any future commitment types in enum order). Use maxResults to limit page size (default 50, max 500). When more items remain, the response includes a non-null pageToken; pass it unchanged on the next request with the same query parameters (service, maxResults). rowCount is the number of items in this page. An invalid pageToken returns 400 with code pagination_token_invalid; an expired token returns 400 with code pagination_token_expired. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Evaluate current AWS commitments, plan and automate purchases, and optimize cloud costs with PerfectScale for Commitments. Returns one item per onboarded AWS organization. Each item includes that AWS organization's commitments purchasing account (purchaseAccountId) and commitment settings for each commitment type activated on that AWS organization (compute, database).

Commitment settings cover recommendation and automation preferences (policy, term, payment option, automation mode, commitment limits, and related fields). They are stored at the customer level per commitment type and therefore have the same values on every AWS organization item. Only purchaseAccountId and which commitment types appear differ per AWS organization.

In the DoiT Console, commitment settings are edited on an account's Settings tab but apply across all AWS organizations for that commitment type; the purchasing account is set per AWS organization on Accounts Settings. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Lists the caller's program management accounts (PMAs) and the reseller tenants mapped to each one, including AWS Organizations handshake status per account. Distributor-only. This endpoint is paginated: to fetch the next page, call again passing the response's pageToken value as the pageToken parameter. Stop once the response has no pageToken — that means there are no more pages.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Lightweight polling surface for the onboarding wizard: returns each of the caller's PMAs with only its IAM status/diff and timestamps — no tenant fan-out, no handshake aggregation, no pagination. Distributor-only.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Lists the end-customer AWS account mappings under a reseller's program management account, identified by dpmaId and resellerPmaAccountId. Callable by the reseller who owns the PMA or the distributor who owns the DPMA.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Same result as GET /billingtransfer/v1/end-customers, identified by resellerPmaAccountId alone (no dpmaId needed). Callable by the reseller who owns the PMA or the distributor who owns its DPMA.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Lists every reseller program management account (RPMA) node belonging to the calling reseller, with handshake state and status but without end-customer tenants — the reseller-tier analog of GET /billingtransfer/v1/programmanagementaccounts.

Manage AWS billing-transfer mappings between distributors and resellers and between resellers and end customers, and list program management accounts. Lists every reseller PMA node belonging to the calling reseller, each with the end-customer tenants connected under it — the reseller-tier analog of GET /billingtransfer/v1/programmanagementaccounts. region, iamStatus and lastRefreshTime are inherited from the parent DPMA root; the reseller node itself carries no IAM/region metadata of its own.

Manage country-based access to tenants in your customer hierarchy. Returns the canonical ISO 3166-1 alpha-2 country catalogue used by geographic access policies.

Manage country-based access to tenants in your customer hierarchy. Returns the ready custom regions owned by the authenticated tenant. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Creates a custom region owned by the authenticated tenant. The tenant must be a customer-hierarchy root. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Returns a custom region owned by the authenticated tenant. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Deletes a custom region owned by the authenticated tenant. Assigned regions cannot be deleted. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Updates the name, country membership, or both for a custom region owned by the authenticated tenant. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Returns the geographic scope for a target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Targets outside that hierarchy are returned as not found. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Atomically replaces the geographic scope for a target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating an identical request is idempotent. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Clears the geographic scope for a target customer, leaving it unassigned. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating the request is idempotent. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Returns the geographic scope assigned to a user who belongs to the target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Targets outside that hierarchy are returned as not found. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Atomically replaces the geographic scope assigned to a user who belongs to the target customer. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating an identical request is idempotent. Requires the UsersManager permission.

Manage country-based access to tenants in your customer hierarchy. Clears the geographic scope assigned to a user who belongs to the target customer, leaving it unassigned. The authenticated tenant must be the hierarchy root, and the target must be that root customer or one of its child customers. Repeating the request is idempotent. Requires the UsersManager permission.